Data obtained from other sources

Document version

Version 1.0. Last updated: 19 August 2026. This notice fulfils Article 14 GDPR for persons whose data were not obtained directly from them.

1. Controller

The controller is Paweł Ciechanowski, prowadzący działalność gospodarczą pod firmą Paweł Ciechanowski, ul. Armii Krajowej 29/30, 30-150 Kraków, Polska, NIP 677-111-07-70. Contact: kontakt@hereditas.biz, telephone +48 883 30 93 13, or postal mail to the controller’s address.

2. Persons concerned

This notice may concern owners and co-owners, heirs, family members, representatives, persons named in documents, contractors, contact persons and other persons connected with a matter reviewed by HEREDITAS.

3. Categories of data

Data may include identification and contact details, family relationships, civil status, name changes, migration, inheritance, property rights, shares, proceedings, documents, powers of attorney, professional or business information and other data relevant to identifying persons, rights and the status of the matter.

Special categories or criminal data are processed only where genuinely necessary and supported by an appropriate legal condition and safeguards.

4. Sources

Data may come from the client or reporting person, family members, representatives, co-owners, contractors and cooperating specialists.

They may also come from lawfully accessible public registers and sources, land and mortgage registers, business registers, court and administrative files, title documents, state, local, civil or church archives to the extent permitted by law, publications, obituaries, genealogical databases and other reliable sources.

5. Purposes and legal bases

Data are processed to assess and qualify a matter, establish ownership and succession, identify owners, co-owners and heirs, verify documents, make contact, prepare options, conduct negotiations, perform agreed work and establish, exercise or defend claims.

The main basis is Article 6(1)(f) GDPR — legitimate interests of the controller or client in clarifying legal and factual status, protecting property rights, making contact and assessing possible action. Articles 6(1)(b) or (c) may apply where appropriate.

Where special-category data are required, an appropriate Article 9(2) condition applies, in particular explicit consent or necessity for legal claims.

6. Recipients and transfers

Data may be accessed by hosting, email and IT providers and, for a specific matter, independent lawyers, genealogists, brokers, valuers, engineers, notaries or other specialists. Disclosure is limited to what is necessary.

Where a provider enables access outside the EEA, Chapter V GDPR mechanisms are used, such as adequacy decisions or standard contractual clauses.

7. Retention

Data are retained for the time needed to assess and handle the matter and then for documenting arrangements and applicable limitation periods. They may be deleted earlier if irrelevant, inaccurate or no longer supported by a legal basis.

Documents subject to legal retention are kept for the required period. Logs and backups follow providers’ technical retention cycles.

8. Rights

A person may request access, rectification, erasure, restriction and may object to processing under Article 6(1)(f); portability applies where relevant. A complaint may be lodged with the President of the Polish Personal Data Protection Office.

Requests should be sent to kontakt@hereditas.biz. Rights may be limited where processing is necessary to protect others’ rights, comply with law or establish, exercise or defend claims.

9. Timing

The information is provided within a reasonable period after obtaining the data, generally no later than one month, and where the data are used for communication — at the latest at the first communication. Article 14(5) GDPR exceptions may apply, for example where the person already has the information or providing it is impossible or would involve disproportionate effort, subject to appropriate safeguards.

10. No automated decisions

Data are not used for solely automated decisions or marketing profiling. Human review is involved in assessment and qualification.

11. Full Privacy Policy

Further information is available in the HEREDITAS Privacy Policy.